levix-bot 2.0.0

package/src/db/store.esm.js

@@ -0,0 +1,17 @@
+// ESM face of the store (src/db/store.cjs).
+//
+// store.cjs has to be CommonJS so the command files and the ESM handlers share
+// one singleton; this wrapper is what the ESM side imports for the lifecycle
+// calls. Data access goes through src/utils/storage.esm.js as it always did.
+
+import { createRequire } from "module";
+
+const require = createRequire(import.meta.url);
+const store = require("./store.cjs");
+
+export const initStore = store.initStore;
+export const flushStore = store.flushStore;
+export const isStoreReady = store.isStoreReady;
+export const pendingWrites = store.pendingWrites;
+
+export default store;

package/src/domain/caddy.js

@@ -0,0 +1,120 @@
+// Caddy: the one web server Levix will install, and only onto a machine that
+// has none.
+//
+// It is the fresh-server choice because it gets and renews the certificate by
+// itself — no certbot step, no cron, nothing for the operator to remember.
+//
+// On a machine that already runs Caddy we add one import line and one site
+// file. We never rewrite somebody's Caddyfile.
+
+const IMPORT_LINE = "import /etc/caddy/levix/*.caddy";
+const SITE_DIR = "/etc/caddy/levix";
+
+export function renderSite({ domain, port }) {
+  return `# Managed by Levix. Rewritten by \`levix domain ${domain}\`.
+${domain} {
+    reverse_proxy 127.0.0.1:${port}
+}
+`;
+}
+
+export function sitePath(domain) {
+  return `${SITE_DIR}/${domain}.caddy`;
+}
+
+/**
+ * Add (or update) the Levix site, validate, reload.
+ *
+ * @returns {{ ok: boolean, path: string, error?: string, reloaded: boolean }}
+ */
+export function applySite(system, { domain, port, caddyfile = "/etc/caddy/Caddyfile" }) {
+  const path = sitePath(domain);
+
+  const existed = system.exists(path);
+  const previous = existed ? system.readFile(path) : null;
+  const hadCaddyfile = system.exists(caddyfile);
+  const previousCaddyfile = hadCaddyfile ? system.readFile(caddyfile) : null;
+
+  system.mkdirp(SITE_DIR);
+  system.writeFile(path, renderSite({ domain, port }));
+
+  // One import line, appended once. Everything else in their Caddyfile is
+  // theirs and stays exactly as it is.
+  const current = hadCaddyfile ? previousCaddyfile : "";
+  if (!current.includes(IMPORT_LINE)) {
+    system.writeFile(
+      caddyfile,
+      `${current}${current.endsWith("\n") || current === "" ? "" : "\n"}\n# Added by Levix — loads its site files.\n${IMPORT_LINE}\n`
+    );
+  }
+
+  const restore = () => {
+    if (existed) system.writeFile(path, previous);
+    else system.remove(path);
+    if (hadCaddyfile) system.writeFile(caddyfile, previousCaddyfile);
+    else system.remove(caddyfile);
+  };
+
+  const validated = system.run("caddy", ["validate", "--config", caddyfile]);
+  if (validated.status !== 0) {
+    restore();
+    return {
+      ok: false,
+      path,
+      reloaded: false,
+      error: (validated.stderr || validated.stdout || "caddy validate failed").trim(),
+    };
+  }
+
+  const reload = system.run("systemctl", ["reload", "caddy"]);
+  if (reload.status !== 0) {
+    return {
+      ok: false,
+      path,
+      reloaded: false,
+      error: `configuration is valid but Caddy did not reload: ${(reload.stderr || "").trim()}`,
+    };
+  }
+
+  return { ok: true, path, reloaded: true };
+}
+
+/**
+ * Install Caddy from its official repository. Only ever called after the
+ * operator has said yes, and only on a machine with no web server at all.
+ */
+export function install(system) {
+  if (system.which("caddy")) return { ok: true, skipped: "already installed" };
+
+  if (system.which("apt-get")) {
+    const script = [
+      "set -e",
+      "apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl",
+      "curl -1sLf https://dl.cloudsmith.io/public/caddy/stable/gpg.key | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg",
+      "curl -1sLf https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt | tee /etc/apt/sources.list.d/caddy-stable.list",
+      "apt-get update",
+      "apt-get install -y caddy",
+    ].join("\n");
+    const result = system.run("sh", ["-c", script], { timeoutMs: 300000 });
+    if (result.status !== 0) {
+      return { ok: false, error: (result.stderr || result.stdout || "").trim() };
+    }
+    return { ok: true };
+  }
+
+  if (system.which("dnf") || system.which("yum")) {
+    const manager = system.which("dnf") ? "dnf" : "yum";
+    const result = system.run("sh", ["-c", `${manager} install -y caddy`], { timeoutMs: 300000 });
+    if (result.status !== 0) {
+      return { ok: false, error: (result.stderr || result.stdout || "").trim() };
+    }
+    return { ok: true };
+  }
+
+  return {
+    ok: false,
+    error: "no supported package manager found (apt-get, dnf or yum)",
+  };
+}
+
+export { IMPORT_LINE, SITE_DIR };

package/src/domain/command.js

@@ -0,0 +1,380 @@
+// `levix domain [name]`
+//
+// Points a domain at Levix by working with whatever is already on the server.
+// It inspects first, decides second, and asks before it changes anything. On a
+// machine it does not understand it prints the exact reverse-proxy settings a
+// person would need and changes nothing at all.
+//
+// The bot itself never needs root. This command may, and says so when it does.
+
+import readline from "node:readline/promises";
+import { createRequire } from "node:module";
+
+import { createSystem } from "./system.js";
+import { inspect, classify, checkDns } from "./detect.js";
+import * as nginx from "./nginx.js";
+import * as caddy from "./caddy.js";
+
+const require = createRequire(import.meta.url);
+const settings = require("../config/settings.cjs");
+const { inContainer } = require("../utils/openBrowser.cjs");
+
+const line = (text = "") => console.log(text);
+const tick = (text) => line(`  ✓ ${text}`);
+const cross = (text) => line(`  ✗ ${text}`);
+
+// A hostname, not a URL and not an IP. Anything else is a typo we can catch
+// before it reaches certbot.
+const DOMAIN_PATTERN = /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/i;
+
+/** Short, reliable guidance per panel. No panel APIs — just where to click. */
+const PANEL_HINTS = {
+  "CloudPanel": 'Sites → Add Site → Reverse Proxy, then "SSL/TLS → Let\'s Encrypt".',
+  "Plesk": "Domains → Hosting & DNS → Apache & nginx Settings → additional nginx directives.",
+  "cPanel / WHM": "WHM → Apache → Reverse Proxy (or ProxyPass in an include file).",
+  "CyberPanel": "Websites → Manage → vHost Conf, then Issue SSL.",
+  "aaPanel": "Website → Settings → Reverse proxy, then Let's Encrypt under SSL.",
+  "HestiaCP": "Web → Edit domain → Proxy Template, then enable Let's Encrypt.",
+  "ISPConfig": "Sites → Options → nginx Directives.",
+  "Coolify": "Add a service pointing at the host port, and let Coolify terminate TLS.",
+  "Dokploy": "Create an application/domain entry pointing at the host port.",
+  "Virtualmin / Webmin": "Services → Configure Website → Edit Directives.",
+};
+
+function proxyInstructions(domain, port, { https = "your panel" } = {}) {
+  line();
+  line("  Configure a reverse proxy with:");
+  line();
+  line(`    Domain:     ${domain}`);
+  line(`    Upstream:   http://127.0.0.1:${port}`);
+  line("    WebSocket:  required (the panel pushes the pairing QR over it)");
+  line(`    HTTPS:      enable from ${https}`);
+  line();
+}
+
+async function ask(question, { assumeYes }) {
+  if (assumeYes) return true;
+  if (!process.stdin.isTTY) {
+    line();
+    line("  Not running interactively. Re-run with --yes to accept, or run it in a terminal.");
+    return false;
+  }
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(`  ${question} [Y/n] `)).trim().toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+
+async function askDomain({ assumeYes }) {
+  if (assumeYes || !process.stdin.isTTY) return null;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return (await rl.question("  Domain (e.g. bot.example.com): ")).trim();
+  } finally {
+    rl.close();
+  }
+}
+
+/**
+ * Remember the domain. `proxied` is what decides the security-relevant part:
+ * only a proxy we actually put in front justifies trusting one hop of
+ * forwarded headers, and only then is it safe to stop listening publicly.
+ */
+function persist({ domain, proxied }) {
+  settings.set("public_domain", domain);
+  if (proxied) {
+    // Exactly one hop: the proxy on this machine. See src/utils/requestOrigin.cjs
+    // for why this does not weaken the first-run check.
+    settings.set("trust_proxy", "1");
+    // Nobody should be able to reach the panel past the certificate by asking
+    // for the raw port.
+    settings.set("bind_address", "127.0.0.1");
+  }
+}
+
+export async function runDomainCommand({ domain = null, assumeYes = false, system } = {}) {
+  const sys = system || createSystem();
+  const port = settings.get("port");
+
+  line();
+  line("  Levix — domain setup");
+  line();
+
+  let name = domain || (await askDomain({ assumeYes }));
+  if (!name) {
+    cross("No domain given. Try: levix domain bot.example.com");
+    return 1;
+  }
+  name = name.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+
+  if (!DOMAIN_PATTERN.test(name)) {
+    cross(`"${name}" doesn't look like a domain name.`);
+    return 1;
+  }
+
+  const report = await inspect(sys, { domain: name, container: inContainer() });
+  const decision = classify(report);
+
+  printFindings(report);
+
+  switch (decision.action) {
+    case "docker":
+      line("  Levix is running inside a container.");
+      line("  A container cannot — and should not — configure the host's web server.");
+      proxyInstructions(name, port, { https: "the host proxy" });
+      persist({ domain: name, proxied: false });
+      tick(`Saved ${name} as the public address.`);
+      return 0;
+
+    case "panel": {
+      line(`  Detected: ${decision.target}`);
+      line();
+      line("  This server appears to be managed by a hosting panel, so Levix will not");
+      line("  touch its web server configuration — the panel would overwrite it, or");
+      line("  break on it.");
+      proxyInstructions(name, port, { https: decision.target });
+      const hint = PANEL_HINTS[decision.target];
+      if (hint) line(`  In ${decision.target}: ${hint}\n`);
+      persist({ domain: name, proxied: false });
+      tick(`Saved ${name} as the public address.`);
+      return 0;
+    }
+
+    case "apache":
+      line("  Apache is installed.");
+      line();
+      line("  Levix does not edit Apache automatically: doing it correctly depends on");
+      line("  which modules and vhost layout this server uses, and getting it wrong");
+      line("  takes other sites down with it.");
+      proxyInstructions(name, port, { https: "certbot --apache" });
+      line("  The proxy needs mod_proxy, mod_proxy_http and mod_proxy_wstunnel.");
+      line();
+      persist({ domain: name, proxied: false });
+      return 0;
+
+    case "blocked":
+      cross(`Port 80/443 is in use by ${decision.target || "an unknown service"}.`);
+      line();
+      line("  Levix will not install or reconfigure a web server on top of something");
+      line("  it doesn't recognise — that would take the other service down.");
+      proxyInstructions(name, port, { https: "that service" });
+      return 1;
+
+    case "nginx":
+      return configureNginx(sys, { name, port, report, assumeYes });
+
+    case "caddy":
+      return configureCaddy(sys, { name, port, report, assumeYes, install: false });
+
+    case "install-caddy":
+      return configureCaddy(sys, { name, port, report, assumeYes, install: true });
+
+    default:
+      cross(`Nothing to do (${decision.reason}).`);
+      return 1;
+  }
+}
+
+function printFindings(report) {
+  const found = [];
+  if (report.nginx.installed) found.push("nginx");
+  if (report.apache.installed) found.push("Apache");
+  if (report.caddy.installed) found.push("Caddy");
+  if (report.certbot) found.push("certbot");
+  if (report.panel) found.push(report.panel);
+
+  line(`  Found: ${found.length ? found.join(", ") : "no web server"}`);
+  for (const port of [80, 443]) {
+    const state = report.ports[port];
+    line(`  Port ${port}: ${state.taken ? `in use by ${state.process || "an unknown process"}` : "free"}`);
+  }
+  line();
+}
+
+function requireRoot(report) {
+  if (report.root) return true;
+  cross("This step edits files under /etc, so it needs root.");
+  line();
+  line("  Re-run it as: sudo levix domain <name>");
+  line();
+  return false;
+}
+
+async function confirmDns(sys, name, { assumeYes }) {
+  const dnsCheck = await checkDns(sys, name);
+
+  if (dnsCheck.status === "ok") {
+    tick("DNS points at this server");
+    return true;
+  }
+
+  if (dnsCheck.status === "unknown") {
+    line("  ? Could not confirm DNS (no public IP available from here).");
+    return ask("Continue anyway?", { assumeYes });
+  }
+
+  const ip = dnsCheck.mine.v4 || dnsCheck.mine.v6 || "<this server's IP>";
+  const [subdomain, ...rest] = name.split(".");
+  const isApex = rest.length < 2;
+
+  cross(
+    dnsCheck.status === "unresolved"
+      ? `${name} does not resolve yet.`
+      : `${name} resolves to ${dnsCheck.resolved.v4.join(", ") || dnsCheck.resolved.v6.join(", ")}, not to this server.`
+  );
+  line();
+  line("  Add this DNS record:");
+  line();
+  line(`    Type:  A`);
+  line(`    Name:  ${isApex ? "@" : subdomain}`);
+  line(`    Value: ${ip}`);
+  if (dnsCheck.mine.v6) {
+    line();
+    line(`    Type:  AAAA`);
+    line(`    Name:  ${isApex ? "@" : subdomain}`);
+    line(`    Value: ${dnsCheck.mine.v6}`);
+  }
+  line();
+  line("  DNS can take a few minutes. HTTPS can't be issued until it resolves.");
+  line();
+
+  return ask("Continue without HTTPS for now?", { assumeYes });
+}
+
+async function configureNginx(sys, { name, port, report, assumeYes }) {
+  if (!requireRoot(report)) return 1;
+
+  const dnsOk = await confirmDns(sys, name, { assumeYes });
+  if (!dnsOk) {
+    line("  Stopped. Nothing was changed.");
+    return 1;
+  }
+
+  line();
+  line(`  Levix will add one nginx site for ${name} and leave every other site alone.`);
+  if (!(await ask("Continue?", { assumeYes }))) {
+    line("  Stopped. Nothing was changed.");
+    return 1;
+  }
+
+  const applied = nginx.applySite(sys, { domain: name, port });
+  if (!applied.ok) {
+    cross("nginx rejected the configuration — nothing was reloaded.");
+    line();
+    line(applied.error.split("\n").map((l) => `    ${l}`).join("\n"));
+    line();
+    line("  The previous state has been restored.");
+    return 1;
+  }
+
+  tick(`nginx site written to ${applied.path}`);
+  tick("nginx -t passed");
+  tick("nginx reloaded");
+
+  let https = false;
+  if (report.certbot) {
+    if (await ask("Issue an HTTPS certificate with certbot?", { assumeYes })) {
+      const cert = nginx.ensureCertificate(sys, { domain: name });
+      if (cert.ok) {
+        https = true;
+        tick(cert.skipped ? `HTTPS: ${cert.skipped}` : "HTTPS certificate issued");
+      } else {
+        cross("certbot failed — the site is up over HTTP.");
+        line();
+        line(cert.error.split("\n").slice(0, 8).map((l) => `    ${l}`).join("\n"));
+        line();
+      }
+    }
+  } else {
+    line();
+    line("  certbot is not installed, so the site is HTTP only for now.");
+    line("  To add HTTPS later:");
+    line("    apt install certbot python3-certbot-nginx");
+    line(`    certbot --nginx -d ${name}`);
+    line();
+  }
+
+  persist({ domain: name, proxied: true });
+  finalUrl(name, https, { restart: true });
+  return 0;
+}
+
+async function configureCaddy(sys, { name, port, report, assumeYes, install }) {
+  if (!requireRoot(report)) return 1;
+
+  if (install) {
+    line("  No reverse proxy was detected.");
+    line("  Caddy is the simplest option here: it gets and renews HTTPS by itself.");
+    line();
+    if (!(await ask("Install Caddy and configure HTTPS?", { assumeYes }))) {
+      line("  Stopped. Nothing was installed.");
+      proxyInstructions(name, port, { https: "whatever proxy you prefer" });
+      return 1;
+    }
+
+    const dnsOk = await confirmDns(sys, name, { assumeYes });
+    if (!dnsOk) {
+      line("  Stopped before installing anything.");
+      return 1;
+    }
+
+    const installed = caddy.install(sys);
+    if (!installed.ok) {
+      cross(`Could not install Caddy: ${installed.error}`);
+      return 1;
+    }
+    tick(installed.skipped ? "Caddy was already installed" : "Caddy installed");
+  } else {
+    line("  Caddy is already running here — Levix will add one site to it.");
+    if (!(await ask("Continue?", { assumeYes }))) {
+      line("  Stopped. Nothing was changed.");
+      return 1;
+    }
+    const dnsOk = await confirmDns(sys, name, { assumeYes });
+    if (!dnsOk) {
+      line("  Stopped. Nothing was changed.");
+      return 1;
+    }
+  }
+
+  const applied = caddy.applySite(sys, {
+    domain: name,
+    port,
+    caddyfile: report.caddy.caddyfile || "/etc/caddy/Caddyfile",
+  });
+  if (!applied.ok) {
+    cross("Caddy rejected the configuration — nothing was reloaded.");
+    line();
+    line(applied.error.split("\n").map((l) => `    ${l}`).join("\n"));
+    line();
+    return 1;
+  }
+
+  tick(`Caddy site written to ${applied.path}`);
+  tick("caddy validate passed");
+  tick("Caddy reloaded");
+  tick("HTTPS will be issued automatically on the first request");
+
+  persist({ domain: name, proxied: true });
+  finalUrl(name, true, { restart: true });
+  return 0;
+}
+
+function finalUrl(name, https, { restart }) {
+  tick("Levix proxy settings updated");
+  line();
+  line(`  Levix will be available at:`);
+  line();
+  line(`    ${https ? "https" : "http"}://${name}`);
+  line();
+  if (restart) {
+    line("  Restart Levix for the new bind address to take effect:");
+    line("    systemctl restart levix     (or stop and start it however you run it)");
+    line();
+  }
+}
+
+export default runDomainCommand;

package/src/domain/detect.js

@@ -0,0 +1,173 @@
+// What is already on this machine, and what that means Levix may do to it.
+//
+// The rule the whole file serves: **Levix integrates with the server it finds;
+// it does not take over the server.** A VPS may be running somebody's shop.
+// Detection therefore never changes anything, and the classification errs
+// towards printing instructions rather than editing another program's config.
+
+const PANELS = [
+  // Strong signals only: a directory a panel owns, not a package that might
+  // have been installed for another reason.
+  { name: "Plesk", paths: ["/usr/local/psa", "/opt/psa"] },
+  { name: "cPanel / WHM", paths: ["/usr/local/cpanel"] },
+  { name: "CyberPanel", paths: ["/usr/local/CyberCP", "/usr/local/CyberPanel"] },
+  { name: "aaPanel", paths: ["/www/server/panel"] },
+  { name: "CloudPanel", paths: ["/home/clp", "/etc/clp", "/usr/local/bin/clpctl"] },
+  { name: "HestiaCP", paths: ["/usr/local/hestia"] },
+  { name: "ISPConfig", paths: ["/usr/local/ispconfig"] },
+  { name: "Coolify", paths: ["/data/coolify"] },
+  { name: "Dokploy", paths: ["/etc/dokploy", "/var/lib/dokploy"] },
+  { name: "Virtualmin / Webmin", paths: ["/etc/webmin/virtual-server"] },
+];
+
+// Programs we know how to work alongside on ports 80/443. Anything else
+// holding those ports means we stop and let a human look.
+const KNOWN_WEB_SERVERS = /^(nginx|apache2?|httpd|caddy|haproxy|traefik|litespeed|openlitespeed)$/i;
+
+/**
+ * Look at the machine. Changes nothing.
+ *
+ * @param {import("./system.js").System} system
+ * @param {object} [context] - what Levix already knows about itself
+ */
+export async function inspect(system, context = {}) {
+  const panel = PANELS.find((entry) => entry.paths.some((path) => system.exists(path))) || null;
+
+  const nginx = {
+    installed: system.which("nginx"),
+    sitesAvailable: system.exists("/etc/nginx/sites-available"),
+    confD: system.exists("/etc/nginx/conf.d"),
+    levixSite: system.exists(nginxSitePath(context.domain, system)),
+  };
+
+  const caddy = {
+    installed: system.which("caddy"),
+    caddyfile: ["/etc/caddy/Caddyfile"].find((path) => system.exists(path)) || null,
+  };
+
+  const apache = {
+    installed: system.which("apache2") || system.which("httpd"),
+  };
+
+  const listeners = system.listeners();
+  const ports = {};
+  for (const port of [80, 443]) {
+    const hit = listeners.find((entry) => entry.port === port);
+    ports[port] = hit ? { taken: true, process: hit.process } : { taken: false, process: null };
+  }
+
+  return {
+    panel: panel ? panel.name : null,
+    nginx,
+    caddy,
+    apache,
+    certbot: system.which("certbot"),
+    systemd: system.which("systemctl"),
+    container: Boolean(context.container),
+    root: typeof process.getuid === "function" ? process.getuid() === 0 : false,
+    ports,
+    listeners,
+  };
+}
+
+/**
+ * Turn a report into a decision.
+ *
+ * @returns {{ action: string, reason: string, target?: string }}
+ *   action is one of:
+ *     docker            — instructions; the host's web server isn't ours to touch
+ *     panel             — instructions; a control panel owns this web server
+ *     blocked           — stop; something unknown holds 80/443
+ *     nginx             — configure a Levix site in the existing nginx
+ *     caddy             — add a Levix site to the existing Caddy
+ *     apache            — instructions; we don't edit Apache automatically
+ *     install-caddy     — nothing is installed; offer to install Caddy
+ */
+export function classify(report) {
+  // A container cannot configure the host's proxy, and installing one inside
+  // the application image would be a second thing to keep alive.
+  if (report.container) {
+    return {
+      action: "docker",
+      reason: "Levix is running inside a container",
+    };
+  }
+
+  // A panel owns its web server's configuration and will overwrite ours, or
+  // break when it can't parse what we wrote.
+  if (report.panel) {
+    return {
+      action: "panel",
+      reason: `${report.panel} appears to manage this server`,
+      target: report.panel,
+    };
+  }
+
+  // Something is on 80/443 that we don't recognise. Installing a web server
+  // now would collide with it; editing it isn't possible either.
+  const unknown = [80, 443]
+    .map((port) => ({ port, ...report.ports[port] }))
+    .find((entry) => entry.taken && !KNOWN_WEB_SERVERS.test(entry.process || ""));
+
+  if (unknown && !report.nginx.installed && !report.caddy.installed && !report.apache.installed) {
+    return {
+      action: "blocked",
+      reason: `port ${unknown.port} is held by ${unknown.process || "an unknown process"}`,
+      target: unknown.process,
+    };
+  }
+
+  // In order of how well we can work with them.
+  if (report.nginx.installed) {
+    return { action: "nginx", reason: "nginx is installed and not panel-managed" };
+  }
+  if (report.caddy.installed) {
+    return { action: "caddy", reason: "Caddy is installed" };
+  }
+  if (report.apache.installed) {
+    return {
+      action: "apache",
+      reason: "Apache is installed, and Levix does not edit it automatically",
+    };
+  }
+
+  if (unknown) {
+    return {
+      action: "blocked",
+      reason: `port ${unknown.port} is held by ${unknown.process || "an unknown process"}`,
+      target: unknown.process,
+    };
+  }
+
+  return { action: "install-caddy", reason: "no web server is installed" };
+}
+
+/** Where a Levix nginx site lives on this distro. */
+export function nginxSitePath(domain, system) {
+  const name = `levix-${domain || "site"}.conf`;
+  if (system.exists("/etc/nginx/sites-available")) return `/etc/nginx/sites-available/${name}`;
+  return `/etc/nginx/conf.d/${name}`;
+}
+
+/**
+ * Does this domain point at this machine?
+ *
+ * Advisory: without a public IP to compare against (no network, an internal
+ * DNS view) it returns `unknown` rather than blocking.
+ */
+export async function checkDns(system, domain) {
+  const [resolved, mine] = await Promise.all([system.resolve(domain), system.publicIp()]);
+
+  if (!resolved.v4.length && !resolved.v6.length) {
+    return { status: "unresolved", resolved, mine };
+  }
+  if (!mine.v4 && !mine.v6) {
+    return { status: "unknown", resolved, mine };
+  }
+  const matches =
+    (mine.v4 && resolved.v4.includes(mine.v4)) || (mine.v6 && resolved.v6.includes(mine.v6));
+
+  return { status: matches ? "ok" : "elsewhere", resolved, mine };
+}
+
+export { PANELS, KNOWN_WEB_SERVERS };